[Purpose/significance] Reveal the generation mechanism of privacy leakage risks among users of medical e-commerce platforms and propose corresponding control strategies to enhance user privacy security in the medical ecommerce sector and safeguard user privacy rights. [Method/process] In-depth interview is conducted to collect ini⁃tial data. Using thematic analysis, the MOA and SOR frameworks are integrated to extract the influencing factors of pri⁃vacy leakage risks in medical e-commerce. The interrelations among these factors are mapped out, and a model for the generation and control mechanism of these risks is constructed. [Result/conclusion] Privacy disclosure motivation, pri⁃vacy protection environment, and privacy literacy, as stimuli, all indirectly influence users' privacy risk control behav⁃iors through the mediation of perceived privacy leakage risk. Furthermore, users' privacy cognitive psychology impacts their perception of privacy leakage risk, moderating the relationship between stimuli and perceived privacy leakage risk, as well as between perceived risk and risk control behaviors. Given this, the research proposes a range of data gov⁃ernance and privacy protection strategies from the dual perspectives of government and platform, including establishing a full lifecycle privacy protection mechanism and implementing graded labeling of privacy information.